<!--
  This file is a part of the open-eBackup project.
  This Source Code Form is subject to the terms of the Mozilla Public License, v. 2.0.
  If a copy of the MPL was not distributed with this file, You can obtain one at
  http://mozilla.org/MPL/2.0/.
  
  Copyright (c) [2024] Huawei Technologies Co.,Ltd.
  
  THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND,
  EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO NON-INFRINGEMENT,
  MERCHANTABILITY OR FIT FOR A PARTICULAR PURPOSE.
  -->

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html lang="zh-cn" xml:lang="zh-cn">
 <head>
  <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
  <meta http-equiv="X-UA-Compatible" content="IE=edge">
  <meta name="DC.Type" content="topic">
  <meta name="DC.Title" content="步骤2：（可选）生成最小权限Token">
  <meta name="product" content="">
  <meta name="DC.Relation" scheme="URI" content="kubernetes_CSI_00024.html">
  <meta name="prodname" content="">
  <meta name="version" content="">
  <meta name="brand" content="">
  <meta name="DC.Publisher" content="20250306">
  <meta name="prodname" content="csbs">
  <meta name="documenttype" content="usermanual">
  <meta name="DC.Format" content="XHTML">
  <meta name="DC.Identifier" content="kubernetes_CSI_00026">
  <meta name="DC.Language" content="zh-cn">
  <link rel="stylesheet" type="text/css" href="public_sys-resources/commonltr.css">
  <title>步骤2：（可选）生成最小权限Token</title>
 </head>
 <body style="clear:both; padding-left:10px; padding-top:5px; padding-right:5px; padding-bottom:5px">
  <a name="kubernetes_CSI_00026"></a><a name="kubernetes_CSI_00026"></a>
  <h1 class="topictitle1">步骤2：（可选）生成最小权限Token</h1>
  <div>
   <p>后续注册Kubernetes集群，当选择了Token认证时，才需要执行本节操作生成最小权限Token。如无特殊需求，可使用超级管理员权限的Token。</p>
   <div class="section">
    <h4 class="sectiontitle">操作步骤</h4>
    <ol>
     <li id="kubernetes_CSI_00026__li6288174805511"><a name="kubernetes_CSI_00026__li6288174805511"></a><a name="li6288174805511"></a><span>查询CCE集群工作节点已绑定的EIP。</span><p></p>
      <ol type="a">
       <li>登录ManageOne运营面。</li>
       <li>依次选择<span class="uicontrol">“服务列表 &gt; 云容器引擎CCE &gt; CCE集群”</span>，单击需要查看的Kubernetes集群名进入集群信息页面。</li>
       <li>依次选择<span class="uicontrol">“集群 &gt; 节点管理”</span>，单击<span class="uicontrol">“节点”</span>页签，查看CCE集群所有工作节点已绑定的EIP。</li>
      </ol> <p></p></li>
     <li><span>通过<a href="#kubernetes_CSI_00026__li6288174805511">1</a>查到的EIP地址，登录Kubernetes集群任意一个节点。</span></li>
     <li><span>创建集群角色资源。在Kubernetes集群节点创建文件“pm-k8s-sa-role.yaml”，并写入以下内容。</span><p></p><pre class="screen">apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: pm-k8s-sa-role
rules:
  - apiGroups: [ "*" ]
    resources: [ "*" ]
    verbs: [ "list", "create", "get" ]
  - apiGroups: [ "*" ]
    resources: [ "pods", "persistentvolumeclaims", "volumesnapshots" ]
    verbs: [ "delete" ]
  - apiGroups: [ "*" ]
    resources: [ "statefulsets", "replicasets", "deployments", "daemonsets", "jobs", "cronjobs" ]
    verbs: [ "patch" ]</pre> <p></p></li>
     <li><span>在Kubernetes集群节点执行<strong>kubectl apply -f pm-k8s-sa-role.yaml</strong>命令，创建ClusterRole。</span></li>
     <li><span>创建服务账户。在Kubernetes集群节点创建文件“pm-k8s-sa.yaml”，并写入以下内容。</span><p></p><pre class="screen">apiVersion: v1
kind: ServiceAccount
metadata:
  name: pm-k8s-sa
  namespace: kube-system</pre> <p></p></li>
     <li><span>在Kubernetes集群节点执行<strong>kubectl apply -f pm-k8s-sa.yaml</strong>命令，创建ServiceAccount。</span></li>
     <li><span>创建ClusterRoleBinding。在Kubernetes集群节点上创建文件“pm-k8s-cluster-role-binding.yaml”，并写入以下内容。</span><p></p><pre class="screen">apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: pm-k8s-cluster-role-binding
subjects:
- kind: ServiceAccount
  name: pm-k8s-sa      
  namespace: kube-system
roleRef:
  kind: ClusterRole
  name: pm-k8s-sa-role
  apiGroup: rbac.authorization.k8s.io</pre> <p></p></li>
     <li><span>在Kubernetes集群节点执行<strong>kubectl apply -f pm-k8s-cluster-role-binding.yaml</strong>命令，创建ClusterRoleBinding。</span></li>
     <li><span>创建Secret保存Token信息。在Kubernetes集群节点上创建文件“pm-k8s-secret.yaml”，并写入以下内容。</span><p></p><pre class="screen">apiVersion: v1
kind: Secret
type: kubernetes.io/service-account-token
metadata:
  namespace: kube-system
  name: pm-k8s-secret
  annotations:
    kubernetes.io/service-account.name: pm-k8s-sa</pre> <p></p></li>
     <li><span>在Kubernetes集群节点执行<strong>kubectl apply -f pm-k8s-secret.yaml</strong>命令，创建Secret。</span></li>
     <li><span>获取最小权限Token。在Kubernetes集群节点上执行<strong>kubectl describe secret/pm-k8s-secret -n kube-system</strong>命令，回显中“token”字段的值即为所需的最小权限Token。</span></li>
    </ol>
   </div>
  </div>
  <div>
   <div class="familylinks">
    <div class="parentlink">
     <strong>父主题：</strong> <a href="kubernetes_CSI_00024.html">备份命名空间/数据集</a>
    </div>
   </div>
  </div>
 </body>
</html>